Guard Snapshot Envelope

Snapshot envelope shape validator. The agent snapshot primitive (v0.9.30) writes a structured envelope to durable storage on drain and reads it back on restart. The guard refuses malformed envelopes at the boundary so a corrupt or tampered snapshot doesn't get partially restored.

Envelope contract: snapshotId, takenAt, frameworkVersion, orchestratorState, inFlight, idempotencyCache (optional), sig, schemaVersion.

Hard caps: - total serialized size (default 50 MiB) - in-flight items count (default 65536 — orchestrator can't legitimately hold more in-flight streams + sagas + outbox- jobs at one moment than that) - schemaVersion must be a positive integer

b.guardSnapshotEnvelope.validate(envelope, opts?) #

{
  profile:   "strict" | "balanced" | "permissive",
  posture:   "hipaa" | "pci-dss" | "gdpr" | "soc2",
}

Validate a snapshot envelope shape. Returns envelope on success; throws on shape refusal.

b.guardSnapshotEnvelope.validate({
  snapshotId: "snap-abc",
  takenAt:    1700000000000,
  frameworkVersion: "0.9.30",
  schemaVersion:    1,
  orchestratorState: {},
  inFlight: {},
});

b.guardSnapshotEnvelope.compliancePosture(name) #

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardSnapshotEnvelope.compliancePosture("hipaa");                   // → "strict"
b.guardSnapshotEnvelope.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.